Ducktapemaster,


I don't know the first thing about computer code, but if you wanted to setup a paypal address to take donations I would certainly contribute to getting the iOS development kit for you. You sound very familiar with software code development.


Maybe the forum Admins could STICKY a thread as part of an independent software development piece to the stock head unit. Maybe even an admin could setup the paypal address and own the development, but then Honda might get pissed and take legal action against the forum.


The understanding would be no guarantees of success obviously, but I'd imagine a few dollars from everyone could cover the cost of the tools you need to investigate. Maybe set a time limit of a year and a donation limit so it doesn't get out of control. Im kinda thinking of it as an independent research cooperative fed by the forum as a platform.


If nothing comes of it because Honda has the source code proprietary and locked away, then at least when the question of jailbreaking the head unit is asked they can see the extensive efforts done to achieve this goal. It may even spur others to join in your cause.


just thinking out loud, but I can only applaud your precision efforts to help the customer base where Honda hides behind legal excuses why various functionality is not made available to the consumer due to "safety" or revenue security of an inferior product.

 

Wow, Bassguitarist, I really appreciate the generosity!

I have to say though, this project is just in its infancy and before I even consider taking people's money I would really love to have a clear plan of action. My hesitancy to spend $100 on some bluetooth sniffing tools isn't because I can't afford it, its just that I want to investigate other options cheaply before I go and dump money into a rathole (an industry term )

I'm more than happy to consider donations once I get a little farther along. If people are willing to spend $400+ on a set of sweet-looking taillights from Japan for their Fit, I'm more than happy to put a little cash forward doing something I love!

Also, if anyone out there has experience that would be helpful in this cause and wants to help out, I'm all ears. Send me a message and lets see how far we can get!

One other thing, if this thread becomes a sticky, it might be good to rename it...

 

You are welcome!

I agree, once you have an established plan of action then I can see setting up a donation avenue.

Yes the fact that we on the forum spend that much on custom taillights, having a jailbroken HDMI is small in comparision in my eyes.

Agreed on the thread name change. Also we should merge any other threads specific to this issue into one so we keep it all in one place to look. ROTTBOY (or any other admin available), if Ducktapemaster can get his efforts off the ground could you help with this?

 

Pulled apart my dash last night: http://imgur.com/a/eDmMM

I was able to remove my unit's SD card and install a SD card extender cable so I can access the card without removing the radio. Unfortunately, it appears the card doesn't have a filesystem on it and probably has all its data stored in a binary format, but I can still get to it with a little effort. Decoding it will be more difficult though.

I found that if I boot the unit without the SD card in, it goes into some sort of upgrade mode. I have a video of it I'll post later. The Honda docs mention some sort of USB upgrade procedure for their previous units (not this one specifically), so that could be a path to do so here as well.

Also, as a test, I removed the CAN bus connector from the back of the unit and was able to verify that the HDMI blocking is achieved through the CAN interface. With the cable disconnected I was unable to display HDMI video, even while the car was in park and the e-brake applied. As soon as I connected the cable again, the video came up.

Next steps:

1. Pull binary data off of the SD card
2. Hook into the B-CAN bus and sniff some data

 

Any updates to this? Sounds interesting. Would love to see how this plays out...

 

DT--In the diagnostics menu of the info center for the EX, you can access the GPS and see its cool display of which satellites it can see, what my longitude and latitude are and which way the car is headed. I drove around for awhile in the diagnostics mode to see how well the GPS functioned as a compass. Works great...but of course nothing else does. It would be so easy for Honda to give us an option to display the GPS info, or at least a compass. I don't believe this would take away from their Navi sales, and it would please EX users--one more nerdy toy!! I agree that the EX has to have a GPS to allow emergency services to find it if it gets hurt. But so much functionality is left on the table, given that the GPS is working all the time, but invisibly.
I admire all your clever sleuthing and have been following your posts with keen interest.

 

Ductapemaster,

Had an idea on the way to work this morning. The LaneWatch video feed will display while the car is moving. Maybe reading the CAN-Bus data from it and from the HDMI to compare would show whats different about the two in order to get the HDMI working while the car is moving. Or maybe we'll luck out and the signal is being sent through a dedicated line, that could be unpinned and replaced.

 

here is a picture of the 6 pin connector for the lanewatch camera. It is "paired" with the head unit, likely through CANBUS data. While the channels are similar and logic behind the execution of the video feed they provide, the connection method is likely different.

 

Thanks for the pic. Does the back of the mirror just snap on? If only the CANBUS had a GUI...or CMD interface that we could get into. I miss the old straight wiring...

 

Sorry for being quiet for a while guys, its been a busy couple weeks.

No progress yet on decoding the SD card contents. I'm working on that though!

I finally received my CAN transceiver chips in the mail and I hope to sniff some data out of the bus this week. My plan right now is to figure out how the unit knows the car is out of park and how fast the car is moving. I have some splicer lines coming out of the CAN bus port that I will connect into. Decoding the protocol may take a while though, considering it isn't documented anywhere.

Also, I have finally succumbed and jailbroken my iPhone! I found a jailbreak app that should allow me to capture bluetooth packets on the fly, so I should be able to see what kind of data is being sent back and forth between my phone and the HondaLink system. I'll let you guys know how this goes!

Also, interesting notes about the LaneWatch camera! Unfortunately, tapping that signal is somewhat of a last resort, since if we change it to be the data from our HDMI connector through some sort of converter, we would still see the LaneWatch overlay when it is enabled.

Here is the pinout for the LaneWatch camera. The wire colors are for the wires coming from the camera, NOT from the head unit!

Red: Power (8V I believe)
Brown: Video Signal
White: Ground
Yellow: HU to Camera communication line
Blue: Camera to HU communication line
Grey: Shield

Haven't found any info about the communication protocol. It's not a CAN line, since its not differential and its not half-duplex, but it might use some variant of the CAN protocol. Only sniffing it will tell us anything. I might investigate this at some point just because its interesting, but right now I think its outside my goals.

 

Yessir, skull just snaps on with 4 clips. Everything is detailed here in my master thread. I took it apart to modify my EX to have the EX-L heated side mirrors with great success!


https://www.fitfreak.net/forums/3rd-...ack-pearl.html

 

I'm sure everyone's been busy with the holidays too, but any more progress?

 

Hello, I drive a Civic which has the same system and I have also been looking into ways to hack it.

I'm guessing the display allows the HDMI connection when the app sends a command via bluetooth. I'm also guessing there's some kind of authentication involved, like a key or something.

The head unit probably has a unique key and the app probably passes keys to and from Honda's server to enable the HDMI function which allows the app to work. The authentication would be done once or periodically after the app starts up. This would explain why the HDMI connection remains open when the app crashes, allowing other apps to be displayed.

The SD card for the headunit is probably also encrypted as well, as I have heard from several sources that the card has to match a specific head unit. If the whole card is encrypted it would appear to be blank without a file system when you try to read it.

As I see it to hack this system two things would need to be accomplished. The bootloader would need to be hacked and the keys would need to be recovered from a device so the firmware could be dumped. With an unlocked bootloader and unencrypted SD card the apps and functions could then be modified.

 

Honda Civic owner here (2015 Civic EX) and I am anxiously following this thread! Our cars have the same limitations with the HDMI input, so I imagine a breakthrough for one will be a breakthrough for all. Thanks Ductapemaster for your crazy hard work on this!

 

One thing I noticed today (while waiting in line at Costco gas ) is that although I have the car in D, I had full access to everything, NAV inputs, address book, HDMI. So I think we can disable the speed control we should be good. Again, I know jack about electronics, just sharing what I noticed.

 

I wish Bluetooth had more throughput so you could stream compressed screen video to the head unit instead -_- Not going to buy a router for mah car lol!


Did anyone try the nav link app with chromecast to see if it works while driving?


Obviously there is encoded data being sent to the head unit via one of hdmi's various data pins. it should be possible to make an hdmi pass through adapter that emulates this signal. I could be wrong... need to hack the app or make friends with the code writer :P

 

Oh I forget, does the touch interface go through the the hdmi or do you need USB plugged in as well?

 

Hi,

I'm not a fit owner, but I have a civic with the same display audio system. Ive been following this forum since I first learned the Power + Eject + Home method for getting into the secret menu. I was playing around today I found that when i went into the functional setup menu and then pressed a combination of Home + Menu + Back at the same time it opened another secret menu.

This lower secret menu is very detailed and i'm afraid to change anything(Some sub menus are in Japanese). To anyone looking to mirror their phone to the 7" screen you are in luck (sort of). There is a video calibration tool that shows the HDMI input regardless of whether its in park. The downside is that there is a few calibration tools that cover a small portion of the bottom and the top. I put google maps on and it was perfectly usable.

The GPS seems to be there to set the time, and you can set it manually if you want as well. The biggest questions I have now that I have seen this new secret menu are about possible features that are locked with this unit. For example there is a Wifi setup, Digital Video Input and DVD Input. There is also a lot of calibration for the navigation which seems odd as I thought the navi unit was different then the non-navi(which I have).

Anyways, if anyone is brave enough to dive deeper into the secret menus, please share any successes with the rest of us.

 

great work, how encouraging! i hope someone with the appropriate background can lead us all to the next step, thank you

 

Figuring i know quite a bit of Japanese, I can try to look into this menu a little.
Ill try it maybe later tonight if i can.
But the video calibration is great!